CVE-2026-3854

CVSS

—

EPSS

0.014 (72.2th percentile)

CISA KEV

Not listed

Exploitation

No report

Public exploits

None seen

State

Unknown

Coverage

• 

  Wiz Research28 Apr, 15:30

  Securing GitHub: Wiz Research uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server (CVE-2026-3854)

  Details on CVE-2026-3854: A critical flaw in GitHub’s internal git infrastructure enabling RCE on GitHub.com and GitHub Enterprise Server.

  ↗wiz.io/blog/github-rce-vulnerability-cve-2026-3…(opens the publisher's site in a new tab)

What we observed